EUVD-2026-66633
GHSA-vgp4-2fc4-qff2
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
PR:H confirmed by mandatory backend permission; scope change (S:C) reflects stored XSS executing in other users' browser sessions; A:N as no availability impact exists.
Primary rating from Vendor (https://github.com/wintercms/winter).
CVSS VectorVendor: https://github.com/wintercms/winter
Lifecycle Timeline
3DescriptionCVE.org
Impact
Authenticated Backend Users with the backend.manage_editor ("Manage editor settings") permission can provide custom styles through Settings → Editor Settings → Markup Styles that are compiled through the LESS CSS parser and rendered on every backend page. Previously, the compiled output was not sanitized, which could have allowed a stored XSS attack.
Although this is a valid security issue, it's important to note that its severity is relatively low. To exploit the vulnerability, an attacker would already need to have trusted access to the Winter CMS backend with a specific administrative permission. The Winter CMS maintainers recommend that the backend.manage_editor permission only be granted to trusted administrators and developers.
A related issue exists in the custom CSS field at Settings → Customize Backend → Styles (backend.manage_branding permission), which uses the same rendering mechanism and is addressed separately.
All users are advised to update to the latest version to ensure their systems remain secure.
Patches
This issue has been patched in v1.2.13. The renderCss() method now applies strip_tags() to compiled CSS output before returning it.
Workarounds
Apply https://github.com/wintercms/winter/commit/d28f0b9474af79cfaa80eeb9d691f7a7c4469720 manually if unable to upgrade to v1.2.13.
Resources
- CVE-2025-61674 (identical vulnerability in October CMS, patched in v3.7.13 and v4.0.12)
AnalysisAI
Stored cross-site scripting in Winter CMS's backend editor settings allows an authenticated backend user holding the backend.manage_editor permission to inject arbitrary JavaScript that executes in the browsers of all other backend users who load any backend page. The attack exploits LESS CSS's escape syntax (~"...") to break out of the CSS context and embed script tags in compiled output served by renderCss(), which was previously returned unsanitized. No public exploit code has been identified at time of analysis, and this is not listed in CISA KEV; however, the class of vulnerability is well understood and the specific payload pattern is documented in the patch's test suite.
Technical ContextAI
Winter CMS is a Laravel-based PHP content management system. The vulnerable component is composer/winter/wn-backend-module, specifically the renderCss() static method present in both EditorSetting.php and BrandSetting.php. These models accept user-supplied LESS CSS strings (stored in the database via the backend settings UI) and compile them using the LESS parser before serving the output inline on every backend page load. The LESS language supports an escape sequence (~"literal") that passes arbitrary text through the parser verbatim without sanitization. An attacker with write access to these settings fields can construct a LESS snippet such as .x { content: ~"</style><script>alert(1)</script><style>"; }, which the LESS compiler emits literally into the CSS output, breaking out of the <style> block and injecting executable script. The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The fix applies PHP's strip_tags() to the compiled output in renderCss() before it is returned, preventing HTML tag injection. An identical vulnerability exists in October CMS (CVE-2025-61674), which shares architectural lineage with Winter CMS.
RemediationAI
Upgrade Winter CMS to v1.2.13, which patches the renderCss() method in both EditorSetting.php and BrandSetting.php by applying strip_tags() to compiled CSS output before it is returned. This is a vendor-released patch and is the recommended remediation. Organizations unable to upgrade immediately can manually apply the single-line fix from commit d28f0b9474af79cfaa80eeb9d691f7a7c4469720 (https://github.com/wintercms/winter/commit/d28f0b9474af79cfaa80eeb9d691f7a7c4469720), which changes both return $customCss; calls to return strip_tags($customCss);. As an organizational control while patching is arranged, administrators should audit which backend accounts hold the backend.manage_editor and backend.manage_branding permissions and reduce that set to only developers and highly trusted administrators - note that revoking these permissions will prevent those users from modifying editor and branding styles. The advisory is at https://github.com/wintercms/winter/security/advisories/GHSA-vgp4-2fc4-qff2.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today